Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 agent
|
afc1701f84 | ||
 markus
|
137dde8122 | ||
|
agent
|
6b6743113f |
No files matched your search
@@ -91,3 +91,47 @@ jobs:
|
||||
echo "$out" | grep -q "linux/$want" || { echo "::error::published image is missing linux/$want"; exit 1; }
|
||||
done
|
||||
echo "✓ ${IMAGE}:${{ inputs.tag }} carries linux/amd64 and linux/arm64"
|
||||
|
||||
# The image is a TOOLCHAIN, so "it built" is not the property that matters
|
||||
# — "it still contains what the gates shell out to" is. This exists because
|
||||
# a hand-built image had drifted from this Dockerfile: the deployed ci3
|
||||
# carried gcc, musl-dev, python3 and py3-yaml, the Dockerfile did not, and
|
||||
# rebuilding from the Dockerfile silently dropped them. CI runs then failed
|
||||
# at "credentials-coverage: need python3" instead of running the tests.
|
||||
#
|
||||
# Asserted on BOTH architectures, because a package that resolves on amd64
|
||||
# and not on arm64 would otherwise reach half the nodes unnoticed.
|
||||
- name: Verify the image still contains the toolchain the gates need
|
||||
if: ${{ steps.meta.outputs.push == 'true' }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REF="${IMAGE}:${{ inputs.tag }}"
|
||||
fail=0
|
||||
for plat in linux/amd64 linux/arm64; do
|
||||
echo "── $plat"
|
||||
out=$(docker run --rm --platform "$plat" --entrypoint sh "$REF" -c '
|
||||
set -u
|
||||
py=$(python3 -c "import yaml,sys;print(sys.version.split()[0])" 2>/dev/null) \
|
||||
&& echo "python3+yaml=$py" || echo "python3+yaml=MISSING"
|
||||
command -v gcc >/dev/null && echo "gcc=ok" || echo "gcc=MISSING"
|
||||
command -v node >/dev/null && echo "node=ok" || echo "node=MISSING"
|
||||
command -v bash >/dev/null && echo "bash=ok" || echo "bash=MISSING"
|
||||
command -v make >/dev/null && echo "make=ok" || echo "make=MISSING"
|
||||
command -v curl >/dev/null && echo "curl=ok" || echo "curl=MISSING"
|
||||
command -v tar >/dev/null && echo "tar=ok" || echo "tar=MISSING"
|
||||
[ -x "$(git --exec-path)/git-http-backend" ] \
|
||||
&& echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
|
||||
' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }
|
||||
echo "$out"
|
||||
if echo "$out" | grep -q MISSING; then
|
||||
echo "$out" | grep MISSING | while read -r l; do
|
||||
echo "::error::$plat is missing a required tool: $l"
|
||||
done
|
||||
fail=1
|
||||
fi
|
||||
done
|
||||
[ "$fail" = 0 ] || {
|
||||
echo "::error::The published image lost a tool the repo's gates depend on. Restore it in the Dockerfile — do not weaken this check."
|
||||
exit 1
|
||||
}
|
||||
echo "✓ toolchain intact on both architectures"
|
||||
+13
-18
@@ -6,15 +6,20 @@
|
||||
# The runner pod is non-root with all caps dropped, so it cannot apt/apk-add at
|
||||
# runtime -- the tools must be baked in here.
|
||||
#
|
||||
# Build multi-arch (cluster is mixed amd64/arm64) and push to the Gitea registry:
|
||||
# PUBLISHING IS AUTOMATED. Run the "build image" workflow on GitHub with a tag
|
||||
# (e.g. 12.11.1-ci4); it builds both architectures and pushes to
|
||||
# ghcr.io/zegit-zoo/zegit-forgejo-runner. ./push-image.sh remains for building
|
||||
# by hand. README.md explains why the registry moved off Gitea (Cloudflare's
|
||||
# request-body cap returns 413 on a registry layer) and why the build cannot run
|
||||
# on our own runners (host mode, all capabilities dropped).
|
||||
#
|
||||
# docker buildx create --use --name zegit-ci 2>/dev/null || true
|
||||
# docker login gitea.langenoja.se # username + a Gitea personal access token
|
||||
# docker buildx build --platform linux/amd64,linux/arm64 \
|
||||
# -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
|
||||
# Then in flux-config set the image on BOTH deployment-zegit-runner and
|
||||
# deployment-forgejo-runner, digest-pinned.
|
||||
#
|
||||
# Then in flux-config set both containers' image: to the tag above and commit.
|
||||
# Package visibility is PUBLIC, so the runner namespace pulls without a secret.
|
||||
# The image is NOT public. Pulls need a registry credential in
|
||||
# forgejo-runner-system -- github-registry-credentials for ghcr.io. An earlier
|
||||
# version of this comment claimed the package was public and needed no secret;
|
||||
# that was wrong for the Gitea registry too, which is private.
|
||||
FROM code.forgejo.org/forgejo/runner:12.11.1
|
||||
|
||||
USER root
|
||||
@@ -33,12 +38,6 @@ USER root
|
||||
# curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries
|
||||
# make -> zegit Makefile targets
|
||||
# ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy
|
||||
# gcc,musl-dev -> C toolchain for cgo; `go test -race` (the Makefile test
|
||||
# target) requires cgo, which needs a C compiler + libc headers
|
||||
# (musl on Alpine)
|
||||
# python3,py3-yaml -> the repo's own gates are Python: credentials-coverage.sh,
|
||||
# validate-admission.sh and feature-lint.sh all shell out to
|
||||
# python3, and credentials-coverage parses manifests with yaml
|
||||
#
|
||||
# Go is intentionally NOT baked in: actions/setup-go fetches the pinned version
|
||||
# per-run (node + tar are present), so the image needs no rebuild on Go bumps.
|
||||
@@ -51,11 +50,7 @@ RUN apk add --no-cache \
|
||||
curl \
|
||||
tar \
|
||||
make \
|
||||
ca-certificates \
|
||||
gcc \
|
||||
musl-dev \
|
||||
python3 \
|
||||
py3-yaml
|
||||
ca-certificates
|
||||
|
||||
# Match the runner pod's runAsUser (1000); keep the image non-root by default.
|
||||
USER 1000
|
||||
Reference in new issue
Block a user